INTERVIEW | Not satisfied with JPC’s response on Privacy Bill: Justice Srikrishna

Express News Service

Last week, the Union government withdrew the Personal Data Protection Bill, 2019, which had been in the woods for five years. The bill was subjected to intense scrutiny by a Joint Parliamentary Committee (JPC), which proposed 81 amendments and 12 recommendations to the bill. After the withdrawal of the bill, Telecom Minister Ashwini Vaishnau promised a new comprehensive bill for public consultation.

Supreme Court Justice BN Srikrishna headed the committee that prepared the first draft of the Privacy Bill in 2018. In an interview with Preetha Nair, he says the way forward is to have a general law passed by Parliament that strictly defines the purposes of curtailing the fundamental right to privacy enshrined in the Puttaswamy judgment.

samples:

Do you welcome the withdrawal of the Privacy Bill 2019? If so, what were your concerns about the bill?
Yes, welcome. I have already publicly criticized the 2019 Bill and its JPVC amendment as being contrary to the law laid down in the Puttaswamy judgment and that we will become an Orwellian state with Big Brother eavesdropping on us freely. It would probably be declared unconstitutional as violating the fundamental right to privacy under Article 21.

You indicated that the bill differs from your draft bill of 2018. How much has the 2019 bill changed from your committee’s recommendations?
It’s like chalk and cheese. It is a fundamental principle of constitutional law that there can be no limitation of a fundamental right except by a valid legislative act. The 2019 bill only allowed this to happen through a self-serving executive declaration.

There is strong criticism of exempting government agencies from the law on the grounds of “public policy”. The criticism was completely justified. There must be some guidelines laid down by an Act of Parliament as to its content, or else our personal data will only be acquired through the ipse dixit of a vague declaration by the executive concerned.

The proportionality doctrine also requires that there be a justification for obtaining personal data without the consent of the person providing the data and that there is no better way to achieve the purpose declared by the legislature for doing so. The principle is that one does not kill a fly with a hammer.

Major tech companies opposed the bill because of its provision of “mandatory data localization.” What is your view?
This fear was exaggerated. If there is constitutionally valid legislation that allows the executive branch to acquire personal data for good reason, and if that data resides on a server outside the country, the local manager would throw up his hands because it would be beyond his reach. However, to urgently confirm the reason for collecting the necessary data, the government would have to deal with the foreign government by reaching out under the slow Mutual Legal Assistance Treaty process, which usually takes about two years to bear fruit. As a compromise, the committee recommended that even if all such data is stored abroad, a live copy should be maintained in India so that emergency access to such necessary data, when needed, can be obtained within India. Lobbying against it was powerful enough for the government to back down.

A lot of effort went into wide public consultation on the 2018 draft. How urgent is consultation?
The law is meant to be people-oriented and for their benefit. Parliament in theory intends to discuss the pros and cons of all laws before passing them, after taking into account all opinions against the bill. As Parliament does not have time for such meticulous detail, a special committee was formed to take part in all stakeholder consultations. This should be mandatory where such new legislation is intended to be passed by Parliament.

Are you satisfied with the JPC recommendations?
Not at all. If the 2019 bill is passed, even with the 84 amendments proposed by the JPC, the main flaws will remain. Furthermore, the Data Protection Authority would be a captive of the government, rather than being an independent body made up of experts and professionals.

You also opposed the JPC’s recommendation to have a single law for personal and non-personal data sets. How damaging will this be to privacy concerns?
It would be harmful both ways. First, only privacy of personal data has been declared a fundamental right. Non-personal data (NPD) is not subject to such privacy. Although the JPC recommendation did not improve the protection of personal data privacy rights, it complicated the situation with the introduction of NPD.

IT minister Ashwini Vaishnau has promised a new project in line with privacy principles. How do you imagine the new bill?
The best way forward is to have a general law passed by Parliament strictly defining the objectives of curtailing the fundamental right to privacy, following the threefold constitutional parameters set out in the Puttaswamy judgment. It is an exercise in balancing three interests. First, the fundamental rights of the people; secondly, the requirements of national security and finally the needs of trade and business to improve the economy. In my opinion, priority should be given to the first, then the second, and then the third objective. This is the least that can be done in a country bound by the principle of social justice.

</p> <p>Last week, the Union government withdrew the Personal Data Protection Bill, 2019, which had been in the woods for five years. The bill was subjected to intense scrutiny by a Joint Parliamentary Committee (JPC), which proposed 81 amendments and 12 recommendations to the bill. After the withdrawal of the bill, Telecom Minister Ashwini Vaishnau promised a new comprehensive bill for public consultation. Supreme Court Justice BN Srikrishna headed the committee that prepared the first draft of the Privacy Bill in 2018. In an interview with Preetha Nair, he says the way forward is to have a general law passed by Parliament that strictly defines the purposes of curtailing the fundamental right to privacy enshrined in the Puttaswamy judgment. Excerpts: Do you welcome the withdrawal of the Privacy Bill 2019? If so, what were your concerns about the bill? Yes, welcome. I have already publicly criticized the 2019 Bill and its JPVC amendment as being contrary to the law laid down in the Puttaswamy judgment and that we will become an Orwellian state with Big Brother eavesdropping on us freely. It would probably have been declared unconstitutional as violating the fundamental right to privacy under Article 21. You have indicated that the Bill deviates from your 2018 Bill. How much has the 2019 Bill changed from your committee’s recommendations? It’s like chalk and cheese. It is a fundamental principle of constitutional law that there can be no limitation of a fundamental right except by a valid legislative act. The 2019 bill only allowed this to happen through a self-serving executive declaration. There is strong criticism of exempting government agencies from the law on the grounds of “public policy”. The criticism was completely justified. There must be some guidelines laid down by an Act of Parliament as to its content, or else our personal data will only be acquired through the ipse dixit of a vague declaration by the executive concerned. The proportionality doctrine also requires that there be a justification for obtaining personal data without the consent of the person providing the data and that there is no better way to achieve the purpose declared by the legislature for doing so. The principle is that one does not kill a fly with a hammer. Major tech companies opposed the bill because of its provision of “mandatory data localization.” What is your view? This fear was exaggerated. If there is constitutionally valid legislation that allows the executive branch to acquire personal data for good reason, and if that data resides on a server outside the country, the local manager would throw up his hands because it would be beyond his reach. However, to urgently confirm the reason for collecting the necessary data, the government would have to deal with the foreign government by reaching out under the slow Mutual Legal Assistance Treaty process, which usually takes about two years to bear fruit. As a compromise, the committee recommended that even if all such data is stored abroad, a live copy should be maintained in India so that emergency access to such necessary data, when needed, can be obtained within India. Lobbying against it was powerful enough for the government to back down. A lot of effort went into wide public consultation on the 2018 draft. How urgent is consultation? The law is meant to be people-oriented and for their benefit. Parliament in theory intends to discuss the pros and cons of all laws before passing them, after taking into account all opinions against the bill. As Parliament does not have time for such meticulous detail, a special committee was formed to take part in all stakeholder consultations. This should be mandatory where such new legislation is intended to be passed by Parliament. Are you satisfied with the JPC recommendations? Not at all. If the 2019 bill is passed, even with the 84 amendments proposed by the JPC, the main flaws will remain. Furthermore, the Data Protection Authority would be a captive of the government, rather than being an independent body made up of experts and professionals. You also opposed the JPC’s recommendation to have a single law for personal and non-personal data sets. How damaging will this be to privacy concerns? It would be harmful both ways. First, only privacy of personal data has been declared a fundamental right. Non-personal data (NPD) is not subject to such privacy. Although the JPC recommendation did not improve the protection of personal data privacy rights, it complicated the situation with the introduction of NPD. IT minister Ashwini Vaishnau has promised a new project in line with privacy principles. How do you imagine the new bill? The best way forward is to have a general law passed by Parliament strictly defining the objectives of curtailing the fundamental right to privacy, following the threefold constitutional parameters set out in the Puttaswamy judgment. It is an exercise in balancing three interests. First, the fundamental rights of the people; secondly, the requirements of national security and finally the needs of trade and business to improve the economy. In my opinion, priority should be given to the first, then the second, and then the third objective. This is the least that can be done in a country bound by the principle of social justice.<br />